Search Engine Erasure (Right to Be Forgotten)

Overview

The right to be forgotten in the search engine context refers to the right of individuals to request that search engine operators delist (remove from search results) links to web pages containing personal data about them. This right was established by the CJEU in Google Spain SL v AEPD (Case C-131/12) and subsequently codified in GDPR Article 17. It requires a balancing exercise between the data subject's privacy rights and the public's right to access information. This skill provides the assessment criteria, request procedures, and operational workflows for both data controllers (whose content may be subject to delisting) and organizations assisting data subjects with delisting requests.

Legal Foundation

CJEU Case C-131/12 — Google Spain SL v AEPD (13 May 2014)

The Court of Justice of the European Union held that:

1. A search engine operator is a data controller in respect of the processing of personal data that appears on web pages published by third parties.
2. The operator of a search engine is obliged to remove from the list of results displayed following a search made on the basis of a person's name, links to web pages published by third parties and containing information relating to that person, if certain conditions are met.
3. The data subject's rights override, as a rule, the interest of internet users in having access to that information, unless particular reasons (such as the role played by the data subject in public life) justify the interference with the data subject's fundamental rights.

CJEU Case C-507/17 — Google LLC v CNIL (24 September 2019)

The Court clarified the territorial scope of de-indexing:

1. EU law does not require that de-indexing be carried out on all versions of the search engine globally.